metasploit | 582e1f591cac39d4158a1e772176b9ec3bf9a6c9bf7e9d39b96724c63954e6dd

Analysis

max time kernel
147s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
Size

150KB
MD5

e5748b60eb6eb72882c02ff6fd119983
SHA1

7945e34394f20de08471cc616beecd015131e9cb
SHA256

582e1f591cac39d4158a1e772176b9ec3bf9a6c9bf7e9d39b96724c63954e6dd
SHA512

5a219f69c45e23ff072a70fa5e5d413eccb85e728161f09eceb7f59790a169583fe3eaead1689c130e817426b97d2abef5eceea2b3b16654234f44de28c01161
SSDEEP

3072:HJQj/azF8FdRMZfoN62wLN6csHVOcoDJYoOxfvtM0k+4zPu4JMkLPpSLd:HJQGad+foNHmoXV8JgM7+4zLJMoPod

Score

10^/10

metasploit backdoor discovery trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 10 IoCs

pid	Process
2968	wificonfig.exe
2988	wificonfig.exe
2624	wificonfig.exe
2100	wificonfig.exe
1672	wificonfig.exe
856	wificonfig.exe
2960	wificonfig.exe
772	wificonfig.exe
680	wificonfig.exe
3028	wificonfig.exe

Loads dropped DLL 20 IoCs

pid	Process
2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
2968	wificonfig.exe
2968	wificonfig.exe
2988	wificonfig.exe
2988	wificonfig.exe
2624	wificonfig.exe
2624	wificonfig.exe
2100	wificonfig.exe
2100	wificonfig.exe
1672	wificonfig.exe
1672	wificonfig.exe
856	wificonfig.exe
856	wificonfig.exe
2960	wificonfig.exe
2960	wificonfig.exe
772	wificonfig.exe
772	wificonfig.exe
680	wificonfig.exe
680	wificonfig.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File created	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe
File opened for modification	C:\Windows\SysWOW64\wificonfig.exe	wificonfig.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wificonfig.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2968	2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2968	2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2968	2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe	31
PID 2328 wrote to memory of 2968	2328	e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe	31
PID 2968 wrote to memory of 2988	2968	wificonfig.exe	32
PID 2968 wrote to memory of 2988	2968	wificonfig.exe	32
PID 2968 wrote to memory of 2988	2968	wificonfig.exe	32
PID 2968 wrote to memory of 2988	2968	wificonfig.exe	32
PID 2988 wrote to memory of 2624	2988	wificonfig.exe	33
PID 2988 wrote to memory of 2624	2988	wificonfig.exe	33
PID 2988 wrote to memory of 2624	2988	wificonfig.exe	33
PID 2988 wrote to memory of 2624	2988	wificonfig.exe	33
PID 2624 wrote to memory of 2100	2624	wificonfig.exe	34
PID 2624 wrote to memory of 2100	2624	wificonfig.exe	34
PID 2624 wrote to memory of 2100	2624	wificonfig.exe	34
PID 2624 wrote to memory of 2100	2624	wificonfig.exe	34
PID 2100 wrote to memory of 1672	2100	wificonfig.exe	35
PID 2100 wrote to memory of 1672	2100	wificonfig.exe	35
PID 2100 wrote to memory of 1672	2100	wificonfig.exe	35
PID 2100 wrote to memory of 1672	2100	wificonfig.exe	35
PID 1672 wrote to memory of 856	1672	wificonfig.exe	36
PID 1672 wrote to memory of 856	1672	wificonfig.exe	36
PID 1672 wrote to memory of 856	1672	wificonfig.exe	36
PID 1672 wrote to memory of 856	1672	wificonfig.exe	36
PID 856 wrote to memory of 2960	856	wificonfig.exe	38
PID 856 wrote to memory of 2960	856	wificonfig.exe	38
PID 856 wrote to memory of 2960	856	wificonfig.exe	38
PID 856 wrote to memory of 2960	856	wificonfig.exe	38
PID 2960 wrote to memory of 772	2960	wificonfig.exe	39
PID 2960 wrote to memory of 772	2960	wificonfig.exe	39
PID 2960 wrote to memory of 772	2960	wificonfig.exe	39
PID 2960 wrote to memory of 772	2960	wificonfig.exe	39
PID 772 wrote to memory of 680	772	wificonfig.exe	40
PID 772 wrote to memory of 680	772	wificonfig.exe	40
PID 772 wrote to memory of 680	772	wificonfig.exe	40
PID 772 wrote to memory of 680	772	wificonfig.exe	40
PID 680 wrote to memory of 3028	680	wificonfig.exe	41
PID 680 wrote to memory of 3028	680	wificonfig.exe	41
PID 680 wrote to memory of 3028	680	wificonfig.exe	41
PID 680 wrote to memory of 3028	680	wificonfig.exe	41

C:\Users\Admin\AppData\Local\Temp\e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\wificonfig.exe
  C:\Windows\system32\wificonfig.exe 476 "C:\Users\Admin\AppData\Local\Temp\e5748b60eb6eb72882c02ff6fd119983_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\wificonfig.exe
    C:\Windows\system32\wificonfig.exe 528 "C:\Windows\SysWOW64\wificonfig.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\SysWOW64\wificonfig.exe
      C:\Windows\system32\wificonfig.exe 540 "C:\Windows\SysWOW64\wificonfig.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 532 "C:\Windows\SysWOW64\wificonfig.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 548 "C:\Windows\SysWOW64\wificonfig.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 564 "C:\Windows\SysWOW64\wificonfig.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:856
        
        C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 552 "C:\Windows\SysWOW64\wificonfig.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 560 "C:\Windows\SysWOW64\wificonfig.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 556 "C:\Windows\SysWOW64\wificonfig.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:680
        
        C:\Windows\SysWOW64\wificonfig.exe
        
        C:\Windows\system32\wificonfig.exe 572 "C:\Windows\SysWOW64\wificonfig.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\wificonfig.exe

Filesize
150KB

MD5
e5748b60eb6eb72882c02ff6fd119983

SHA1
7945e34394f20de08471cc616beecd015131e9cb

SHA256
582e1f591cac39d4158a1e772176b9ec3bf9a6c9bf7e9d39b96724c63954e6dd

SHA512
5a219f69c45e23ff072a70fa5e5d413eccb85e728161f09eceb7f59790a169583fe3eaead1689c130e817426b97d2abef5eceea2b3b16654234f44de28c01161

Download Submit
memory/680-100-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/772-94-0x0000000002690000-0x000000000275E000-memory.dmp

Filesize
824KB

Download
memory/772-91-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/856-77-0x00000000028E0000-0x00000000029AE000-memory.dmp

Filesize
824KB

Download
memory/856-76-0x00000000028E0000-0x00000000029AE000-memory.dmp

Filesize
824KB

Download
memory/856-73-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/1672-67-0x00000000027A0000-0x000000000286E000-memory.dmp

Filesize
824KB

Download
memory/1672-64-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2100-56-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2328-14-0x00000000027A0000-0x000000000286E000-memory.dmp

Filesize
824KB

Download
memory/2328-15-0x00000000027A0000-0x000000000286E000-memory.dmp

Filesize
824KB

Download
memory/2328-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2328-0-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2328-1-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2328-24-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2624-47-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2624-45-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2960-83-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2968-29-0x0000000002880000-0x000000000294E000-memory.dmp

Filesize
824KB

Download
memory/2968-25-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2968-21-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2968-20-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/2988-34-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2988-40-0x0000000002910000-0x00000000029DE000-memory.dmp

Filesize
824KB

Download
memory/2988-36-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/3028-107-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download
memory/3028-109-0x0000000000400000-0x00000000004CD5A1-memory.dmp

Filesize
821KB

Download